https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T20:41:16.856841+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/drupal-contrib-2026-113 DRUPAL-CONTRIB-2026-113 2026-09-28T20:41:18.962959+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/entity

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties.

The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability.

This vulnerability is mitigated by the fact that the JSON:API module must be enabled in combination with the Entity API module.

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-81158 fkie_cve-2026-81158 2026-09-28T20:41:18.963169+00:00

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

 https://vulnerability.circl.lu/vuln/ghsa-3wf5-7hjw-48cg GHSA-3wf5-7hjw-48cg 2026-09-28T20:41:18.963227+00:00

Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.